-
Cybersecurity researchers have disclosed details of a new malware family dubbed YiBackdoor that has been found to share “significant” source code overlaps with IcedID and Latrodectus. “The exact connection to YiBackdoor is not yet clear, but it may be used in conjunction with Latrodectus and IcedID during attacks,” Zscaler ThreatLabz said in a Tuesday report. “YiBackdoor is able to execute
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Think payment iframes are secure by design? Think again. Sophisticated attackers have quietly evolved malicious overlay techniques to exploit checkout pages and steal credit card data by bypassing the very security policies designed to stop them. Download the complete iframe security guide here. TL;DR: iframe Security Exposed Payment iframes are being actively exploited by attackers using
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A severe security vulnerability in OnePlus OxygenOS has been discovered that allows any installed application to read SMS and MMS messages without requesting permission or notifying users.
The flaw, designated CVE-2025-10184, affects multiple OnePlus devices running OxygenOS versions 12 through 15, potentially compromising SMS-based multi-factor authentication (MFA) systems and exposing sensitive personal communications to unauthorized access.
Cybersecurity firm Rapid7 identified this permission bypass vulnerability across several OnePlus smartphone models, including the OnePlus 8T, OnePlus 10 Pro 5G, and potentially other devices in the ecosystem.
The vulnerability stems from improperly secured internal content providers within the Android Telephony package (com.android.providers.telephony) that can be exploited through SQL injection techniques.
OnePlus OxygenOS Vulnerability
The vulnerability exploits Android’s content provider system, which manages structured data access across applications.
OnePlus introduced three additional exported content providers in their OxygenOS implementation that are not present in stock Android: PushMessageProvider, PushShopProvider, and ServiceNumberProvider.
These providers contain inadequate permission controls and lack proper SQL injection protections.
The most critical flaw exists in the ServiceNumberProvider class, where the update method accepts arbitrary SQL code through the where parameter without sanitization.
Malicious applications can exploit this weakness to perform blind SQL injection attacks, utilizing Boolean inference techniques to extract SMS data character by character from the device’s message database, as the report states.
The exploitation process involves crafting SQL queries with UNION SELECT statements and substr functions to systematically extract message contents.
This vulnerability presents significant security implications beyond simple message interception.
The flaw effectively bypasses Android’s READ SMS permission system, allowing malicious applications to access SMS data silently without user consent or system notifications.
Most critically, this compromises SMS-based MFA systems used by banking applications, social media platforms, and other security-sensitive services.
Risk Factors Details Affected Products OnePlus devices running OxygenOS 12, 14, and 15 (e.g. 8T, 10 Pro) Impact Unauthorized read of SMS and MMS data and metadata; silent bypass of SMS-based MFA Exploit Prerequisites 1. Vulnerable OxygenOS version with unprotected Telephony content providers
2. At least one row in exposed table or ability to insert dummy row
3. Malicious app installed on deviceCVSS 3.1 Score 7.8 (High) Mitigations
The vulnerability affects OxygenOS versions 12, 14, and 15 across multiple device models. Notably, the OxygenOS 11 versions tested were not vulnerable, suggesting the security flaw was introduced during the OxygenOS 12 development cycle in 2021.
Rapid7 estimates the issue could affect surveillance activities by state-sponsored adversaries and authoritarian regimes seeking to monitor communications.
OnePlus has remained unresponsive to Rapid7’s disclosure attempts since May 2025, leading to public disclosure without vendor coordination.
Users can mitigate exposure by removing non-essential applications, transitioning from SMS-based MFA to authenticator applications, and utilizing end-to-end encrypted messaging platforms for sensitive communications until OnePlus releases security patches addressing CVE-2025-10184.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post OnePlus OxygenOS Vulnerability Allows Any App to Read SMS Data Without Permission appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A serious security flaw in the Salesforce CLI installer (sf-x64.exe) has been assigned CVE-2025-9844. This weakness allows attackers to execute arbitrary code with SYSTEM-level privileges on Windows machines. Users who installed Salesforce CLI from untrusted sources may be at risk. The vulnerability stems from improper handling of file paths during installation, which can be abused […]
The post Salesforce CLI Installer Flaw Lets Attackers Run Code and Gain SYSTEM-Level Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Since August 2024, a financially motivated threat group has been targeting Android users in Indonesia and Vietnam with banking trojans disguised as official government identity and payment applications. By employing elaborate download mechanisms, reusing infrastructure, and leveraging template-based spoofed sites, the operators have used a coordinated campaign to evade detection and steal user credentials. The […]
The post Banking Trojans Targeting Android Users Disguise as Government and Trusted Payment Apps appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A critical vulnerability in the Salesforce CLI installer (sf-x64.exe) enables attackers to achieve arbitrary code execution, privilege escalation, and SYSTEM-level access on Windows systems.
Tracked as CVE-2025-9844, the flaw stems from improper handling of executable file paths by the installer, allowing malicious files to be executed in place of legitimate binaries when the software is obtained from untrusted sources.
Path Hijacking Vulnerability (CVE-2025-9844)
The vulnerability exploits how the Salesforce-CLI installer resolves file paths during installation. When sf-x64.exe runs, it loads several auxiliary executables and DLLs from the current working directory before falling back to the directory containing the installer.
An attacker who places a crafted executable named identically to a legitimate component (for example, sf-autoupdate.exe or sf-config.dll) in the same folder can cause the installer to load and execute the attacker’s code.
Because the installer runs with elevated privileges by default, writing registry keys under HKLM and creating services under LocalSystem, the injected code inherits SYSTEM-level privileges, enabling complete takeover of the host machine.
Upon execution, the installer loads the rogue sf-autoupdate.exe, which escalates privileges by creating a reverse shell service under the LocalSystem account. The attacker then uses the shell to execute commands and successfully retrieves SYSTEM-level output.
Risk Factors Details Affected Products Salesforce CLI installer (sf-x64.exe) versions < 2.106.6 Impact Arbitrary code execution; privilege escalation to SYSTEM-level access Exploit Prerequisites Installer obtained from untrusted source; attacker places malicious executable in installer’s working directory; installer run with elevated privileges CVSS 3.1 Score 7.8 (High) Affected Versions and Mitigation
All Salesforce-CLI versions prior to 2.106.6 are impacted by this path hijacking vulnerability.
Importantly, only users who install the CLI from untrusted mirrors or third-party repositories are at risk; installations directly downloaded via the official Salesforce site use a signed installer that enforces strict path resolution and integrity checks.
To remediate, affected users should immediately uninstall any CLI version obtained from unverified sources and perform a thorough system scan for unknown executables or suspicious services.
Salesforce has released version 2.106.6, which fixes the issue by hard-coding absolute file paths and validating digital signatures before loading supplementary executables.
Administrators are advised to enforce installation from trusted endpoints only and to enable Microsoft Defender Application Control (MDAC) policies to restrict execution of unauthorized binaries in installation directories.
Continuous monitoring of system event logs for unexpected service creation or installer execution under non-standard paths will help detect attempted exploits early.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post Salesforce CLI Installer Vulnerability Let Attackers Execute Code and Gain SYSTEM-Level Access appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Federal cybersecurity agency CISA has disclosed that attackers exploited a remote code execution vulnerability in GeoServer to breach a U.S. federal civilian executive branch agency. The incident response began after endpoint detection alerts sounded at the agency. Over three weeks, cyber intruders used the flaw to gain initial access, move laterally, and establish persistence across […]
The post CISA Reveals Hackers Breached U.S. Federal Agency via GeoServer RCE Flaw appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A severe Stored Cross-Site Scripting (XSS) vulnerability in the Prompt module of the DNN Platform enables low-privilege attackers to inject and execute arbitrary scripts in the context of privileged users. Published as GHSA-2qxc-mf4x-wr29 by Daniel Valadas yesterday, this vulnerability affects all versions of the DotNetNuke.Core package prior to 10.1.0 and carries a CVSS v3.1 base […]
The post Critical DNN Platform Vulnerability Let Attackers Execute Malicious Scripts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Libraesva has issued an emergency patch for a significant command injection vulnerability in its Email Security Gateway (ESG) after confirming state-sponsored hackers exploited it.
The flaw, identified as CVE-2025-59689, allowed attackers to execute arbitrary commands by sending a malicious email with a specially crafted compressed attachment. The company responded by deploying an automated fix to customers within 17 hours of discovering the active exploitation.
The vulnerability originates from improper sanitization when the ESG product processes certain compressed archive formats. Attackers could construct a malicious email attachment that, when scanned by the gateway, would bypass security checks and allow the injection of shell commands.
A successful exploit would grant the attacker the ability to execute arbitrary commands on the affected system, albeit as a non-privileged user.
From there, the actor could potentially engage in lateral movement, establish persistence, or attempt to escalate privileges. The flaw impacts all Libraesva ESG versions from 4.5 onwards.
Confirmed State-Sponsored Attack
Libraesva confirmed at least one incident where the vulnerability was actively abused in the wild. The company attributes the attack to a “foreign hostile state entity,” highlighting the sophisticated nature of the threat actor.
According to Libraesva, the targeted nature of the attack, which focused on a single appliance, underscores the precision and strategic intent of the adversary.
This targeted approach suggests the attackers were not conducting a widespread campaign but rather a focused operation against a specific organization.
In response to the exploit, Libraesva took swift action, developing and deploying a patch in just 17 hours. The emergency update was automatically pushed to all cloud-based and on-premise ESG appliances running version 5.x.
The comprehensive patch not only addressed the root sanitization flaw but also included an automated scanner to detect Indicators of Compromise (IoCs) and a self-assessment module to verify the patch’s integrity.
Libraesva has provided the following guidance for its customers:
- Cloud Customers: All cloud appliances have been automatically updated, and no further action is required.
- On-Premise 5.x Customers: These appliances should have received the automatic update. Administrators are advised to verify that their system is running a patched version.
- On-Premise 4.x Customers: Versions below 5.0 are End of Support (EOS) and did not receive the automatic patch. These customers must manually upgrade to a supported 5.x version to protect their systems from this exploited vulnerability.
The fixes are available in versions 5.0.31, 5.1.20, 5.2.31, 5.3.16, 5.4.8, and 5.5.7. Given the active exploitation by a nation-state actor, organizations using Libraesva ESG are urged to ensure their appliances are running a patched version immediately.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post Hackers Exploiting Libraesva Email Security Gateway Vulnerability to Inject Malicious Commands appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sophisticated cybercrime campaign has emerged that transforms legitimate AWS infrastructure into weaponized attack platforms through an innovative combination of containerization and distributed denial-of-service capabilities.
The ShadowV2 botnet represents a significant evolution in cyber threats, leveraging exposed Docker daemons on Amazon Web Services EC2 instances to establish persistent footholds for large-scale DDoS operations.
This campaign demonstrates an alarming shift toward professional, service-oriented cybercrime infrastructure that mirrors legitimate cloud-native applications in both design and functionality.
The attack begins with threat actors operating from GitHub CodeSpaces, utilizing a Python-based command-and-control framework to scan for and exploit misconfigured Docker installations.
Unlike traditional botnet operations that rely on pre-built malicious containers, ShadowV2 employs a unique multi-stage deployment process that creates custom containerized environments directly on victim machines.
The malware establishes communication with its operators through a RESTful API architecture, implementing sophisticated polling and heartbeat mechanisms that ensure persistent connectivity while evading detection through legitimate-appearing network traffic.
Darktrace analysts identified the malware during routine honeypot monitoring, discovering that the campaign specifically targets AWS EC2 instances running exposed Docker daemons.
.webp)
The login UI (Source – Darktrace) The researchers observed the threat actors using advanced attack techniques including HTTP/2 rapid reset attacks, Cloudflare under-attack mode bypasses, and large-scale HTTP flood campaigns.
These capabilities, combined with a fully operational user interface and OpenAPI specification, indicate that ShadowV2 functions as a comprehensive DDoS-as-a-service platform rather than a traditional botnet, offering paying customers the ability to launch sophisticated distributed attacks against targeted infrastructure.
.webp)
A snippet showing the fasthttp client creation loop (Source – Darktrace) The malware’s architecture reveals a concerning level of professionalism, with the entire operation designed around a modular, service-oriented approach that includes user authentication, privilege management, and attack limitations based on subscription tiers.
This evolution represents a fundamental shift in cybercrime economics, where malicious infrastructure increasingly resembles legitimate software-as-a-service offerings in terms of user experience, reliability, and feature completeness.
Technical Infection and Deployment Mechanism
The ShadowV2 botnet employs a sophisticated three-stage deployment process that distinguishes it from conventional Docker-based malware campaigns.
Initial compromise occurs through Python scripts hosted on GitHub CodeSpaces, identifiable through distinctive HTTP headers including
User-Agent: docker-sdk-python/7.1.0andX-Meta-Source-Client: github/codespaces.These indicators reveal the attackers’ use of the Python Docker SDK library, which enables programmatic interaction with Docker daemon APIs to create and manage containerized environments on target systems.
.webp)
The poll mechanism (Source – Darktrace) The attack methodology deviates significantly from typical Docker exploitation patterns. Instead of deploying pre-built malicious images from Docker Hub or uploading custom containers, the malware first spawns a generic Ubuntu-based setup container and dynamically installs necessary tools within it.
This container is then committed as a new image and deployed as a live container with malware arguments passed through environmental variables including
MASTER_ADDRandVPS_NAMEidentifiers.The containerized payload consists of a Go-based ELF binary located at
/app/deploymentthat implements a robust communication protocol with the command-and-control infrastructure.Upon execution, the malware generates a unique
VPS_IDby concatenating the providedVPS_NAMEwith the current Unix timestamp, ensuring distinct identification for each compromised system.This identifier facilitates command routing and maintains session continuity even across malware restarts or reinfections.
The binary establishes two persistent communication loops: a heartbeat mechanism that transmits the
VPS_IDtohxxps://shadow.aurozacloud[.]xyz/api/vps/heartbeatevery second via POST requests, and a command polling system that querieshxxps://shadow.aurozacloud[.]xyz/api/vps/poll/<VPS_ID>every five seconds through GET requests.This dual-channel approach ensures both operational visibility for attackers and reliable command delivery to compromised infrastructure, while maintaining the appearance of legitimate API traffic that can evade network-based detection mechanisms.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
The post ShadowV2 Botnet Exploits Docker Containers on AWS to Turn Thems as Infected System for DDoS Attack appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
